PT-2019-19989 · Ethereum · Web3

Publicado 2019-05-30 · Atualizado 2019-05-30

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions web3 versions (affected versions not specified)

Description The issue concerns Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this issue likely requires a Cross-Site Scripting vulnerability to access the private key.

Recommendations Consider using an alternative module until a fix is made available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

GHSA-27V7-QHFV-RQQ8

Produtos afetados

Web3

Referências · 5

• https://github.com/ethereum/web3.js · Nota
• https://github.com/ethereum/web3.js/issues/2739 · Nota
• https://snyk.io/vuln/SNYK-JS-WEB3-174533 · Nota
• https://npmjs.com/advisories/877 · Nota
• https://osv.dev/vulnerability/GHSA-27v7-qhfv-rqq8 · Aviso do Fabricante